x.509-Directory Authentication Service

Defines a framework for authentication service using the X.500 directory.It is the Repository of public-key certificates,Based on use of public-key cryptography and digital signatures.

1. X.509-DIRECTORY AUTHENTICATION SERVICE

2. X.509 Authentication Service Introduction „ ITU-T X.509 : Part of X.500 Directory Services Issued in 1988; revised in 1993 and 1995 Defines a framework for authentication service using the X.500 directory Repository of public-key certificates„ Based on use of public-key cryptography and digital signatures Recommends use of RSA

3. Public-key Certificates „ Associated with user Created by trusted third party Certificate authority (CA) Placed in directory by CA or by the user Directory server „location for certificate access does not create the certificates

4. X.509 Certificate Format The general format for a certificate is: „Version V „Serial number SN „Signature algorithm identifier AI „Issuer Name CA „Period of Validity T A

5. „Subject Name A „Subject’s Public-key Information A p „Issuer Unique Identifier (added in Version 2) „Subject Unique Identifier (added in Version 2) „Extensions (added in Version 3) „Signature

6. X.509 Standard Notation „User certificates generated by a CA use the following standard notation: CA<<A>> = CA {V, SN, AI, CA, T A , A, A p } where Y <<X>> = the certificate of user X issued by the certification authority Y Y {I} = the signing of I by Y consisting of I with an encrypted hash code appended .

7. X.509 : Obtaining A User Certificate user certificates generated by a CA have the following characteristics : „Any user with access to the public key of the CA can recover the user public key that was certified . „No party other than the CA can modify the certificate without being detected. „Since they are unforgeable,they can be placed in a directory without the need for the directory to make special efforts to protect them.

8. X.509: CA Trust Issues If all users subscribe to the same CA, then there is a common trust of that CA. „All user certificates can be placed in the directory for access by all users. „Any user can transmit his/her certificate directly to other users. „Once B is in possession of A’s certificate, B has confidence that: „Messages it encrypts will be secure. „Messages signed with A’s private key are unforgivable.

9. X.509: Multiple CAs „Large User Community „Not Practical to Support All Users „More Practical to Have Multiple CAs „Each CA Provides Its Public Key to A Smaller User Group

10. X.509: Authentication Procedures Three alternative authentication procedures for X.509 Directory Authentication Service „Each use public-key signatures „Each assumes that two parties know each other’s public key. „either obtained from Directory „or obtained in an initial message